Zabbix

Overview

The Zabbix integration connects your Zabbix Cloud or self-hosted Zabbix (7.0 or later) instance to Oneleet, syncing the instance’s users as user account assets and its authentication settings as an instance asset. This lets Oneleet monitor who has access to Zabbix and whether signing in requires multi-factor authentication (MFA).

What does Oneleet monitor?

• Zabbix users (user accounts), including each user’s role and whether they’re deactivated
• Whether every user who can sign in to the Zabbix frontend must use MFA
• Whether MFA is turned on for the instance, with at least one MFA method, and required by every active user group

Zabbix’s API shows whether MFA is required for a user, not whether they have already enrolled. Users enroll the first time they sign in after MFA is required.

Setup

To set up the Zabbix integration, navigate to Integrations > Add integration > Zabbix.

Oneleet connects with an API token and your instance’s domain. Zabbix only shows authentication and MFA settings to users whose role type is Super admin, so the token must belong to a Super admin user.

1. Sign in to the Zabbix frontend as a Super admin. The address you open it at, without https://, is your Instance domain, e.g. acme.zabbix.cloud or zabbix.example.com. Include the port or path if your instance uses one, e.g. example.com/zabbix.
2. Optionally, create a dedicated user for Oneleet: open Users → Users, click Create user, enter a Username, add the user to a group such as Zabbix administrators, set a password, and on the Permissions tab choose the Super admin role. Click Add. See Configuring a user.
3. Open Users → API tokens and click Create API token. See API tokens.
4. Enter a Name, e.g. Compliance monitoring, choose the Super admin User from step 1 or 2, and leave Set expiration date and time cleared, or pick a date and remember to replace the token before it expires. Keep Enabled selected.
5. Click Add, then copy the Auth token shown. Zabbix shows it only once.
6. In Oneleet, enter your Instance domain, paste the token into API Token, and click Connect.

The token must be able to reach your instance’s https://<instance domain>/api_jsonrpc.php over the internet. If your instance is behind a firewall, allow it before connecting.

Warning: While we will only ever read your Zabbix data, the Super admin role grants full access to your instance. Zabbix doesn’t offer a read-only role that can see authentication and MFA settings.

Requiring MFA

1. Open Users → Authentication, select the MFA settings tab, check Enable multi-factor authentication, add a TOTP or Duo Universal Prompt method, and click Update. See MFA.
2. Open Users → User groups, and for each group whose members sign in to the frontend, open the group, set Multi-factor authentication to Default or a specific method, and click Update.

Zabbix doesn’t let you change the MFA setting of a group you’re a member of yourself, so for your own groups, sign in as another Super admin who isn’t in them.